what is a good forensic software to find hidden / deleted files?

[berbes]

after 15+ years with none, i've now gotten three calls this year from spouses looking to find nefarious files on their significant other's pc. i know nothing about them, so, i'm hoping for some direction in that kind of software.

as always, THANKS!!!
berbes

 

[COLGeek]

Windows can find nearly all files by showing hidden files. Nothing special is needed, in most cases.

If the files are encrypted, that is another matter and likely not accessible without the decryption key.

That being the case, why do you ask about this?

 

[berbes]

hiya COLGeek. i've always heard about police doing forensic investigation on pc's to find child porn, stolen docs, etc., and after all these years, now i'm getting calls from people wanting me to find bad things on their pc, especially deleted files/evidence. i just want to make sure i'm not missing something. thanks!

 

[darkbreeze]

Are you a private investigator or something along those lines? There ARE programs that can be used to hide files even from Windows, but most people wouldn't know about or employ them.

WinDirSat can detect ANY files on a storage device, hidden or not. Once you know they're there, finding them becomes a lot easier although as the COL has said if they are encrypted, it won't do you much good to know they're there unless you have the key to decrypt them.

WinDirSat: https/windirstat.net/

 

[USAFRet]

hiya COLGeek. i've always heard about police doing forensic investigation on pc's to find child porn, stolen docs, etc., and after all these years, now i'm getting calls from people wanting me to find bad things on their pc, especially deleted files/evidence. i just want to make sure i'm not missing something. thanks!

Police forensics is a far cry from you're trying to do.
Counselor for the defense: "Prove to the court that these so-called "files" were not planted there by you or the plaintiff."


What is your background that people are coming to you asking for assistance with this?
There are tools and methods, but it's not something you learn overnight.

 

[berbes]

Hello again, USAFRet. Good to hear from you again. I have NO background in any investigative field. Only licensed in multiple finance (Series 4, 6, 7, etc). I only work with computers, nothing more...although at 57 I think I'd ROCK a trenchcoat (only on a very foggy night). I'll tell you, it seems to be a possible new line of income for what PC techs do. I think for the couple I've done this year, it provided proof that it was (or wasn't) time to discuss their relationship. You're dead-on about getting ripped apart on any stand to testify. Nothing better/worse than a great attorney.

when i was 100% in finance, an avenue of income for the brokerage was to provide expert witness testimony to bolster FINRA arbitration claims. i guess all we have is our resume to give any weight to anything I might find on a hard drive.

 

[darkbreeze]

Yeah, there's a big difference between proving it to court, and proving it to a spouse who happens to be sitting there beside you when you find the files. In a lot of cases, these people aren't trying to find legal evidence, just evidence to support an already existing suspicion. I have a very good friend who is a private investigator and generally comes to me for advise regarding PC related matters, and most of his computer related stuff is usually from a spouse who says "I know my husband/wife is doing X. Please find the evidence on here for me" and either gives you local access or brings you the device.

Rarely do those findings end up in court, unless it's divorce court.

 

[COLGeek]

See here:

https/resources.infosecinstitute.com/computer-forensics-tools/#gref

Be careful. The laws regarding these matters vary widely, by jurisdiction. You could easily find yourself on the wrong side of such matters.

 

[berbes]

thank you guys so much for this great info. you are absolutely right, COLGeek. as darkbreeze posted, this is exactly that; a poor lady who loves her husband of 37 years and is afraid of an affair.

so far, i've haven't found anything in any of the prior cases. whew.

 

[darkbreeze]

There are softwares that can be installed to track keystrokes and take periodic screenshots based on triggers and things of that nature, but as USAFRet pointed out the legality of it is complex and is different from state to state. It would be best to do a fair amount of legal research and probably even speak with some local private investigators and attorneys before going further. One misstep could result in a really bad situation.

 

[cwdata09]

send the customer to a computer forensic examiner all done legal